Privacy Policy

1. General provisions

1.1. This Policy explains how personal data is processed for:

• visitors to https://beautyscode.com;
• buyers of digital products;
• users of the MY BEAUTY CODE personal account;
• subscribers to the BEAUTY CODE by INNA newsletter.

1.2. Data controller: Individual Entrepreneur (FOP) Mykola Mykolaiovych Zhurylo.

• RNOKPP: 3033400456.
• Address: 14 Kropotkina Street, Zhovti Vody, Ukraine.
• Email: beautycodebyinna@gmail.com.

2. Categories of personal data

2.1. Order data: order ID, the Buyer's email address, product, amount, currency and payment status, received from WayForPay.

2.2. Subscription data: subscription status, start and end dates of billing periods, cancellation date and details of recurring charges (date, amount, status), received from WayForPay.

2.3. Consent records: the fact of consent to the immediate supply of digital content and of consent to recurring charges, their date and time and the version of the text, stored with the relevant order or subscription.

2.4. MY BEAUTY CODE account data:

• email address;
• password hash (the password itself is not stored);
• sign-in security data (failed attempts, temporary lock-outs);
• hashed session tokens and sign-in or set-password link tokens;
• records of purchased access rights.

2.5. Registered device data: to the extent necessary to apply the three-device limit, including the dates on which devices are registered and replaced.

2.6. Usage data: the number and time of PDF downloads (to apply the limit of three downloads per day), online reading progress and saved positions.

2.7. Other:

• support requests;
• records of newsletter consent and unsubscribing.

2.8. Technical data:

• IP address;
• browser data;
• security logs;
• strictly necessary cookies.

2.9. The website does not receive or store full payment card details: these are entered in the WayForPay payment environment.

3. Purposes and legal bases

3.1. Performance of the contract:

• confirming payment;
• taking out, renewing and cancelling subscriptions;
• sending sign-in or set-password emails;
• providing access to purchased materials;
• applying the download and device limits;
• support and access recovery.

3.2. Compliance with legal obligations, including accounting, tax, evidence of consents given and the handling of requests.

3.3. Legitimate interests:

• protecting accounts and paid content;
• preventing abuse;
• keeping the website running reliably.

3.4. Consent: sending marketing emails. Consent may be withdrawn at any time.

3.5. Transactional emails are sent regardless of marketing consent. They include:

• purchase and subscription confirmations;
• notices of subscription price changes;
• notices of service discontinuation.

3.6. Optional analytics and advertising cookies are used only with the user's consent.

4. Recipients of personal data

4.1. WayForPay — to process one-off and recurring payments.

4.2. Resend — to deliver transactional and newsletter emails.

4.3. Hosting and data storage providers — to host the website and store account, order and subscription data.

4.4. Each provider receives only the data it needs to perform its function.

4.5. Personal data is not sold to third parties. No analytics or advertising services are in use as of this version.

5. International transfers

Serving international buyers and using providers based abroad may involve transferring personal data across borders. Such transfers take place only where there is a legal basis and appropriate safeguards. Where the General Data Protection Regulation (GDPR) applies, its requirements are also met.

6. Retention periods

6.1. Order, payment and subscription data is kept:

• for as long as necessary to perform the contract and handle requests and disputes;
• for the periods required by accounting and tax legislation.

6.2. Consent records are kept for as long as necessary to evidence the consent given and to protect the parties' rights.

6.3. The MY BEAUTY CODE account and access records are kept for as long as the account exists. After deletion, they are kept only to the extent required by law.

6.4. Validity of sessions and links:

• sign-in sessions — up to 30 days;
• password reset links — 1 hour;
• set-password links — 7 days;
• email access links — 72 hours.

6.5. Rate-limiting records are kept in hashed form and deleted after approximately two days.

6.6. Download and device data is kept for as long as necessary to apply the relevant limits.

6.7. Other technical logs are kept only to the extent and for as long as necessary for security and diagnostics.

6.8. Newsletter data is processed until consent is withdrawn. A minimal unsubscribe record may be kept to prevent further emails being sent.

7. Rights of the data subject

7.1. Users have the right to:

• access their data;
• have it rectified;
• have it erased where the law provides, including deletion of the MY BEAUTY CODE account;
• object to processing;
• withdraw consent;
• data portability where the GDPR applies.

7.2. Requests should be sent to beautycodebyinna@gmail.com.

7.3. Users may also contact the Ukrainian Parliament Commissioner for Human Rights and, where the GDPR applies, the supervisory authority in their country.

8. Security and minors

8.1. Organisational and technical measures are in place to protect personal data, including:

• hashing of passwords and tokens;
• encrypted connections;
• rate limiting;
• restricted staff access.

8.2. The website and products are intended for adults.

9. Cookies and updates to this Policy

9.1. The use of cookies is described in the Cookie Policy.

9.2. The current version of this Policy is published at https://beautyscode.com.